chore(security): pin claude-code-action to known-good v1.0.174

[abir-vim]

Automated fleet sync of the org security scanner. Pins claude-code-action off the floating @v1 tag (which regressed at v1.0.175+ and silently no-ops on Bedrock, failing the scan gate closed) to the known-good SHA. See scanner-org for the source template.

[github-actions]

Security Scanner Results

Critical	High	Medium	Low	Info	Dep BLOCK	Dep WARN
0	0	1	0	1	0	0

Findings

• 🟡 allowed_bots: "*" disables the bot-abuse guard for all bot actors — .github/workflows/security.yml:170
  • Remediation: Replace the "*" wildcard with an explicit allowlist of the bot logins you actually intend to scan (e.g. renovate[bot],dependabot[bot] plus your gitops bot). This preserves the intended behavior while keeping the action's abuse guard active for every other bot actor.
• ⚪ Bot-authored PR diff now reaches the AI scanner, but the sink is tool-restricted — .github/workflows/security.yml:171
  • Remediation: Keep --allowedTools tightly scoped (no gh pr comment, gh api, gh issue, arbitrary Bash, or network-write tools) so untrusted diff content can never escalate through the model. Treat any expansion of the allowlist as a change that must be re-reviewed against this bot-trigger path.

Gate blocks at severity critical or a dependency marked BLOCK. Full history in scanner-stats.